Data Processing Agreement (DPA)

Introduction

This Data Processing Agreement ("Agreement") describes how subprocessors handle personal data on behalf of Artometrics ("Controller") when providing hosting, authentication, payment, or support services for artometrics.com.

It applies when the EU General Data Protection Regulation ("GDPR") or UK GDPR governs the processing of personal data submitted through Artometrics membership, contact, or account features.

Definitions

• Personal Data: Information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• Processor: A service provider that processes Personal Data on Artometrics' documented instructions.
• Data Subject: The individual whose Personal Data is processed.

Scope and purpose

Processors engaged by Artometrics may process account email addresses, authentication identifiers, billing metadata, support correspondence, and technical logs strictly to deliver the Services described in our Privacy Policy and Terms of Service.

Processing terms

1. Instructions. Processors process Personal Data only on documented instructions from Artometrics, unless required by law.
2. Security. Processors implement appropriate technical and organizational measures for the risk involved.
3. Subprocessing. Processors do not engage further subprocessors without Artometrics' authorization or a contractual chain that preserves equivalent protections.
4. Data subject rights. Processors assist Artometrics in responding to access, correction, deletion, and portability requests where applicable.
5. Breach notification. Processors notify Artometrics without undue delay after becoming aware of a Personal Data breach affecting Artometrics users.

Representative subprocessors

Artometrics may use providers such as:

• Netlify — site hosting and serverless functions
• Supabase — authentication and account database services
• Stripe — subscription billing and payment processing

The current list may change as infrastructure evolves. Material additions will be reflected in our Privacy Policy or vendor documentation where required.

Duration and termination

This Agreement remains in effect while a Processor handles Personal Data for Artometrics. Upon termination, Processors delete or return Personal Data according to contract terms and applicable law, unless retention is legally required.

Governing law

This Agreement is governed by the same jurisdiction described in the Artometrics Terms of Service, except where GDPR or UK GDPR requires otherwise for affected Data Subjects.

Contact

Data processing questions can be sent through the contact page.